GHSA-jfjg-vc52-wqvf: BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

Summary

BentoML's docker.system_packages field in bentofile.yaml accepts arbitrary strings that are interpolated unescaped into Dockerfile RUN commands. A crafted bentofile.yaml therefore executes attacker-chosen shell commands during bentoml containerize or docker build, including in CI/CD pipelines and when BentoCloud builds user-supplied configs. The flaw affects all versions supporting that field, confirmed on 1.4.36.

Mitigation

Option 1 (recommended): add a regex validator to system_packages in src/bentoml/_internal/bento/build_config.py that permits only alphanumeric characters, dots, plus signs, hyphens, underscores and colons in package names. Option 2: apply shlex.quote() to each package name before interpolation in images.py:system_packages() and apply the bash_quote Jinja2 filter in base_debian.j2.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• bentomlPyPINo LLM dependency detected · 1 tracked dependent

Related items

• MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
• MediumAI broke the cybersecurity world. What’s next?Similar attack · The Verge (AI)
• InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
• MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog